Skip to content

Back to the catalog

WSO2 Trusted AI Governance
github.compaper

WSO2 Trusted AI Governance

WSO2 CTO Asanka Abeysinghe's architectural thesis argues that agentic AI systems break specification-based governance and instead require a control system spanning discovery, first-class agent identity and delegation, parameter-aware boundary authorization, runtime safety (prompt injection, jailbreaks, tool misuse, data exfiltration), deliberate human oversight, centrally-authored/distributedly-enforced policy, evidentiary observability, and economic (cost/budget) controls. It distinguishes inline governance (embedded in agent code) from infrastructure-enforced governance (gateways, proxies, service meshes, model/API gateways) and proposes a control-plane/data-plane split as the load-bearing pattern, referencing EU AI Act, NIST AI RMF, ISO 42001, and MCP registries as systems of record.

TL;DR WSO2's vendor-neutral capability model for governing agentic AI systems, built on identity/delegation, parameter-aware boundary enforcement, runtime safety, and a control-plane/data-plane split.
Open original ↗

Organisations named here

  • California AI Transparency Act
  • Gartner
  • ISO 42001

Technologies named here

  • Model Context Protocol
  • EU AI Act
  • NIST AI RMF

Techniques named here

  • Prompt Injection
  • Jailbreaking
  • Tool Misuse
  • Data exfiltration through legitimate paths
  • Unsafe retries
  • Excessive fan-out
  • Permitted-but-wrong action
  • Social engineering pattern execution
  • Economic attack via malicious prompt
  • Shadow AI usage

Related in AI Security